4 ms·
Startup idea: ultra-secure webmail (accessed via one of those little physical key-generating token thingies). None of this "I've forgotten my password but here
by hugh 18y ago
Startup idea: ultra-secure webmail (accessed via one of those little physical key-generating token thingies).
None of this "I've forgotten my password but here's my mother's maiden name" crap.
- tptacek 18y agoA startup that does no-frills, genuinely secure mail on hardened servers might in fact do pretty well. I've wanted one a lot lately. It's not an easy problem though; you're going to deliberately sacrifice features for security, a tradeoff most customers won't get. It won't solve this problem though; funnelling mail through Yahoo comes with plausible deniability. Funneling it through the email security vault, not so much.
- quasimojo 18y agodoesn't change the vector of this attack one bit: weak password
- tptacek 18y agoWeak password wasn't the vector. Weak password reset feature was.
- hugh 18y agoYes it does change that vector. I'm talking about the physical tokens which generate a new key every 30 seconds, like: http://www.rsa.com/node.aspx?id=1156 http://www.rsa.com/node.aspx?id=1156 This way you need to know the password _and_ have the physical token in your hand to know the current key. On the downside, it's also a hassle to carry it around and use it (I have a couple of 'em for access to various supercomputers), so I wouldn't bother doing it for my own email, but if you're a public figure or otherwise sufficiently paranoid it might be worthwhile.
- rbanffy 18y agoFor just a couple bucks a month you buy a virtual server you can install your IMAP server and do VPN or SSL (or both, just in case).
- tptacek 18y agoBecause I have time to audit and re-audit dovecot's source code at every release? We host our own mail right now, on qmail, but there's no workable IMAP or POP solution I would trust out of the box. Hence, I'd pay money for someone else to do this.